syslog issues...

[Kenneth Platz]

Hello everyone,

In attempting to diagnose some perceived issues with one of my HP-UX 11.11 servers, I tried looking into my syslog... only to find it was completely empty except for entries logged by sudo. So to hunt this down, I checked out the syslog.conf file:

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none;auth.debug @138.126.163.247
*.alert /dev/console
*.alert root
*.emerg *

Hmm... okay, well, we were instructed to send syslogs to a syslog server that we don't control in addition the local syslog... but we stlil need the local syslog. So I added back in the line:

*.info;mail.none;auth.debug /var/adm/syslog/syslog.log

back to the /etc/syslog.conf -- right before the remote syslog server entry, stopped & restarted the syslogd... only to find that it's STILL not logging anything to syslog!

As far as patches, we have the following syslog-related patches on the system:

[/var/adm/syslog] root@arrey #swlist -l product | grep -i syslog
PHCO_36095 1.0 syslogd(1M) cumulative patch
PHKL_26705 1.0 syslog/console handling,printf panic fix
PHKL_30105 1.0 remove mem module and LPMC syslog msgs


Can anyone offer some suggestions as to how to un-messup the syslog?

[Dennis Handly · Accepted solution]

Make sure you have tabs and not spaces.

[Roberto Arias]

hi
first try logger -p info "test" and look for 'test' in syslog.log
my syslog.conf is ( i have syslog and syslog-ng):
auth.info /var/adm/syslog/auth.log
mail.info /var/adm/syslog/mail.log
*.info;mail.none;auth.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *
# DSAU clog mail forwarding.
mail.debug @server-repository
# DSAU clog syslog forwarding.
*.info;mail.none @server-repository

[Kenneth Platz]

That fixed it... changed the spaces to tabs and stopped/restarted. Thanks for the help!